WRITTEN  STATEMENT  TO  THE  UNITED  STATES  SENATE 
COMMITTEE  ON  THE  JUDICIARY 


IN  THE  MATTER  OF  CAMBRIDGE  ANALYTICA  AND  OTHER 
RELATED  ISSUES 


OPENING  REMARKS 

1.  Mr  Chairman,  Senators  -  Thank  you  for  your  invitation 
and  opportunity  to  speak  to  your  committee. 

2.  American  democracy  matters.  It  matters  not  just  to  the 
American  citizens  who  vote,  organise,  protest,  run  for 
office  or  to  those  who  just  speak  their  minds.  American 
democracy  matters  to  the  world  which  so  often  looks  to 
the  United  States  for  leadership  in  defending  and 
promoting  democratic  ideals.  But  to  defend  democracy 
around  the  world,  the  United  States  must  defend  its  own 
at  home.  As  Ronald  Reagan  cautioned,  democracy  is 
not  a  fragile  flower,  but  still  it  needs  cultivating. 

3.  Democracy  is  a  bipartisan  issue.  I  do  not  intend  to  make 
this  a  partisan  testimony  and  I  welcome  questions  from 
all  members.  Although  Cambridge  Analytica  may  have 
supported  particular  candidates  in  US  elections,  I  am  not 
here  to  point  fingers.  The  firm’s  political  leanings  are  far 
less  relevant  than  the  broader  vulnerabilities  this  scandal 
has  exposed.  It  should  also  be  said  that  the  actions  of 
one  rogue  company  are  not  necessarily  reflective  of  the 
character  of  its  past  clients  or  candidates. 

4.  This  should  be  about  moving  forward  to  protect 
democratic  institutions  from  rogue  actors  and  hostile 
foreign  interference,  as  well  as  ensuring  the  safety  of 
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Americans  online,  which  is  something  I  know  both 
Democrats  and  Republicans  care  deeply  about. 

5.  I  am  a  Canadian  citizen  who  is  resident  in  the  United 
Kingdom.  I  have  come  here  today  voluntarily  as  a 
witness  and  as  a  whistleblower.  I  reported  these  matters 
to  the  responsible  UK  authorities  months  before  the 
stories  were  made  public  by  the  Guardian,  New  York 
Times  and  Channel  4,  and  it  should  be  made  clear  that  I 
am  considered  a  witness  by  both  the  British  and 
American  authorities. 

6.  On  26  March  2018,  the  UK  Information  Commissioner 
personally  confirmed  in  writing  that  I  am  “not  a  subject  of 
[their]  investigation”. 

COMPANY  ORIGINS 

7.  I  was  the  Director  of  Research  for  SCL  and  Cambridge 
Analytica  from  mid  2013  to  late  2014.  SCL  Group  was  a 
UK  based  military  contractor,  which  worked  for  the  US 
and  UK  militaries  and  also  worked  at  the  NATO 
StratComm  Centre  in  the  Baltic  region. 

8.  Cambridge  Analytica  (“CA”)  was  created  by  SCL  Group 
with  funding  from  Robert  Mercer,  an  American  billionaire 
based  in  New  York.  Robert  Mercer  installed  Steve 
Bannon  as  CA’s  Vice  President  with  responsibilities  to 
manage  the  company  day-to-day.  Mr  Mercer’s  daughter, 
Rebekah  Mercer,  also  played  a  role  in  the  company. 

9.  Mr  Bannon  is  a  follower  of  the  Breitbart  Doctrine,  which 
posits  that  politics  flows  downstream  from  culture. 
Therefore,  Mr  Bannon  sees  cultural  warfare  as  the 
means  to  create  enduring  change  in  American  politics.  It 
was  for  this  reason  Mr  Bannon  engaged  SCL,  a  foreign 
military  contractor,  to  build  an  arsenal  of  informational 
weapons  he  could  deploy  on  the  American  population. 
Mr  Bannon  wanted  to  use  the  same  kinds  of  information 
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operations  tactics  used  by  the  military  for  his  political 
aims  in  the  United  States  and  elsewhere. 

10.  CA  was  created  as  the  front-facing  American  brand  to 
allow  SCL  to  work  in  the  USA.  I  was  informed  that  this 
setup  was  largely  to  get  around  various  electoral 
compliance  and  foreign  agent  restrictions  in  the  USA. 
CA  did  not  have  any  employed  staff,  only  an  intellectual 
property  agreement  and  data  assets  it  received  from 
SCL.  SCL  assigned  all  its  intellectual  property  (“IP”)  to 
CA  and  in  return,  CA  licensed  back  this  same  IP  and  all 
CA  clients  would  be  handed  to  SCL  staff. 

1 1 .  SCL  and  Mr  Mercer’s  lawyers  decided  upon  the  setup.  I 
later  learned  that  one  advantage  of  this  complicated 
setup  was  that  funds  invested  by  Mr  Mercer  and  his 
investment  vehicles  would  not  necessarily  be  considered 
declarable  campaign  contributions.  Rather,  monies 
transferred  for  the  firm’s  research  and  development 
(“R&D”)  would  be  classed  investments  not  donations, 
even  if  that  R&D  ended  up  supporting  political  clients. 
This  allowed  the  firm  to  develop  IP  worth  far  more  than 
the  value  of  each  client  contract  it  had  with  the 
campaigns  it  was  supporting. 

12.  The  majority  of  SCL  staff  were  not  American  citizens. 
Although  Mr  Bannon  was  formally  warned  about  the 
implications  of  using  foreign  citizens  in  US  elections  in  a 
legal  memorandum,  the  firm  disregarded  this  advice  and 
proceeded  to  install  Alexander  Nix,  a  British  national 
resident  in  London,  as  CEO,  and  sent  non-US  citizens  to 
play  strategic  roles  embedded  in  American  campaigns. 
To  be  clear,  during  my  time  at  CA,  I  never  directly 
worked  in  any  of  the  firm’s  supported  American 
campaigns,  nor  did  I  exert  strategic  or  managerial 
influence  on  those  campaigns,  nor  was  I  responsible  for 
those  SCL/CA  staff  hiring  and  deployment  decisions. 

13.  The  ethos  of  the  firm  was  ‘anything  goes’.  I  witnessed 
some  senior  staff  even  going  so  far  as  attempting  to 
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divert  health  ministry  funds  in  a  struggling  African 
country  to  support  a  politician’s  re-election  campaign. 
To  be  clear,  I  was  not  myself  involved  in  inducing  any 
public  official  to  misuse  their  position. 

14.  By  taking  advantage  of  countries  with  still-developing 
civic  institutions,  the  firm  was  a  corrupting  force  in  the 
world  and  became  the  face  of  what  colonialism  looks  like 
in  the  21st  century. 

USE  OF  HACKED  MATERIALS 

15.  When  I  was  at  SCL  and  CA,  I  was  made  aware  of  the 
firm’s  “black  ops”  capacity,  which  I  understood  to  include 
using  hackers  to  break  into  computer  systems  to  acquire 
kompromat  or  other  intelligence  for  its  clients.  The  firm 
referred  to  these  operations  as  “special  intelligence 
services”  or  “special  IT  services”.  I  have  been  told  about 
and  seen  documents  relating  to  several  instances  where 
SCL  or  CA  procured  hacked  material  for  the  benefit  of  its 
clients.  Some  of  the  targets  of  these  intelligence 
operations  are  currently  heads  of  state  in  various 
countries.  Of  concern,  some  of  the  former  CA  staff  who 
worked  on  these  projects  currently  hold  senior  positions 
in  the  British  government.  I  have  also  seen  internal  CA 
documents  that  make  reference  to  using  specialised 
technologies  and  intelligence  gathering  services  from 
former  members  of  Israeli  and  Russian  state  security 
services.  Mr  Bannon  was  Vice  President  at  the  time  of 
some  of  these  events. 

16.  Of  further  concern  is  CA’s  links  to  people  closely 
associated  with  Wikileaks  and  Julian  Assange.  The  firm 
hired  two  senior  staff,  both  of  whom  were  previously 
aides  to  John  Jones  QC  in  London.  Mr  Jones  was  the 
British  lawyer  who  represented  Julian  Assange, 
Wikileaks  and  members  of  the  Gaddafi  regime.  He  later 
killed  himself  by  walking  in  front  of  a  train  in  2016.  I 
believe  that  part  of  the  appeal  of  hiring  these  staff 
members  was  their  pervious  work  with  Mr  Jones, 
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including  the  association  with  Mr  Assange.  At  least  one 
of  these  staff  members  was  involved  in  a  project  that 
procured  and  used  hacked  materials  on  an  election 
campaign.  Although  the  firm  claimed  only  brief  contact 
with  Mr  Assange,  recordings  of  SCL  Group’s  former 
CEO  suggest  that  contact  with  Wikileaks  began  18 
months  prior  to  the  US  election. 

17.  I  realise  these  are  very  serious  allegations,  and  to  be 
clear,  I  have  already  reported  the  matter  to  the  UK 
National  Crime  Agency,  which  is  co-ordinating  a  multi- 
jurisdictional  investigation  with  their  American  colleagues 
in  the  Federal  Bureau  of  Investigation  (“FBI”).  I  have 
also  been  contacted  directly  by  the  FBI  and  the  US 
Department  of  Justice,  and  I  intend  to  fully  co-operate 
with  their  investigations. 

18.  To  be  clear,  I  have  never  authorised,  facilitated  or 
otherwise  procured  the  services  of  hackers  for  CA  or 
anyone  else.  I  have  therefore  been  informed  by  both 
British  and  American  authorities  that  I  am  not  a  target  of 
these  investigations. 

FACEBOOK  DATA  HARVESTING 

1 9.  Between  2013  and  2015,  CA  funded  a  multi-million  dollar 
operation  called  Project  Ripon.  This  project  was 
overseen  by  Mr  Bannon  and  was  based  upon  research 
that  was  originally  conducted  by  psychologists  at  the 
University  of  Cambridge. 

20.  It  should  be  noted  that  some  of  the  profiling  research 
used  as  the  basis  of  CA  operations  had  declared  funding 
from  the  US  Defense  Advanced  Research  Projects 
Agency  (“DARPA”). 

21.  The  purpose  of  Ripon  was  to  develop  and  scale 
psychological  profiling  algorithms  for  use  in  American 
political  campaigns.  To  be  clear,  the  work  of  CA  and 
SCL  is  not  equivalent  to  traditional  marketing,  as  has 
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been  claimed  by  some.  This  false  equivalence  is 
misleading.  CA  specialised  in  disinformation,  spreading 
rumours,  kompromat  and  propaganda.  Using  machine 
learning  algorithms,  CA  worked  on  moving  these  tactics 
beyond  its  operations  in  Africa  or  Asia  and  into  American 
cyberspace. 

22.  CA  sought  to  identify  mental  and  emotional 
vulnerabilities  in  certain  subsets  of  the  American 
population  and  worked  to  exploit  those  vulnerabilities  by 
targeting  information  designed  to  activate  some  of  the 
worst  characteristics  in  people,  such  as  neuroticism, 
paranoia  and  racial  biases.  This  was  targeted  at  narrow 
segments  of  the  population. 

23.  For  those  who  claim  that  profiling  does  not  work,  this 
contradicts  copious  amounts  of  peer-reviewed  literature 
in  top  scientific  journals,  including  the  Proceedings  of  the 
National  Academy  of  Science  (“PNAS”),  Psychological 
Science  and  the  Journal  of  Personality  and  Individual 
Differences.  Even  Facebook  itself  has  applied  for  a  US 
patent  on  “determining  user  personality  characteristics 
from  social  networking  system  communications  and 
characteristics”. 

24.  The  Russian-American  researcher  Dr  Aleksandr  Kogan 
was  selected  to  lead  the  data  harvesting  operation,  as 
he  offered  the  use  of  Facebook  apps  which  he  had 
developed  in  his  academic  role  to  collect  personal  data 
about  Facebook  users  and  their  friends.  However,  I  later 
learned  that  Dr  Kogan  did  not  have  permission  from 
Facebook  to  exploit  the  app’s  privileged  access  for 
commercial  or  political  activities.  This  has  been 
confirmed  to  me  in  legal  correspondence  with  Facebook. 

25.  Dr  Kogan  developed  data  harvesting  applications  that 
would  capture  not  only  the  original  app  user  but  would 
harvest  all  the  personal  data  of  that  user’s  Facebook 
friends  and  connections  -  without  their  knowledge  or 
explicit  consent. 
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CA  did  not  conduct  due  diligence  to  ensure  that  Dr 
Kogan  had  authorisation  before  spending  circa  1  million 
US  dollars  on  this  scheme.  However,  CA  has  a  history 
of  seeking  out  data  with  dubious  provenance.  For 
example,  the  company  contracted  a  partner  firm  in  an 
attempt  to  acquire  live  Internet  service  provider  (“ISP”) 
data  to  tacitly  monitor  the  Internet  browsing  habits  of 
voters  in  the  Caribbean  without  their  knowledge  or 
consent. 

27.  As  Facebook  has  now  confirmed,  over  80  million  data 
subjects  had  their  personal  data  misappropriated  in  the 
Ripon  programme,  many  of  whom  were  American 
citizens.  Given  this  scale,  Ripon  could  be  one  of  the 
largest  breaches  of  Facebook’s  data. 

28.  CA  often  stored  or  transmitted  data  in  insecure  formats, 
including  files  of  hundreds  of  thousands  of  Americans’ 
data  being  passed  around  via  unencrypted  e-mails.  CA 
also  allowed  access  to  its  American  datasets  to  external 
contractors,  including  senior  staff  from  the  company 
Palantir,  which  is  a  contractor  to  the  US  National 
Security  Agency  (“NSA”).  To  be  clear,  Palantir  denies 
having  any  formal  relationship  with  CA  and  states  this 
work  was  apparently  done  in  a  “personal  capacity”. 

29.  SCL  has  a  documented  history  of  poor  handling  of 
sensitive  data.  In  2014,  SCL  Group,  the  parent  of  CA, 
was  criticised  by  the  UK  Defence  Science  and 
Technology  Laboratory  for  its  inability  to  properly  handle 
sensitive  Ministry  of  Defence  information.  This  Ministry 
of  Defence  assessment  was  conducted  the  same  year 
as  the  Facebook  data  harvesting  scheme. 

RUSSIAN  CONTACT 

30.  At  the  time,  Dr  Kogan  was  also  working  on  Russian 
state-funded  research  projects.  He  was  based  at  times 
in  St  Petersburg  and  also  would  fly  to  Moscow.  The 
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Russian  team  at  St  Petersburg  was  also  building  similar 
algorithms  using  Facebook  data  for  psychological 
profiling.  The  Russian  project  had  a  particular  focus  on 
the  “dark  triad”  traits  of  narcissism,  Machiavellianism  and 
psychopathy.  The  Russian  project  also  conducted 
behavioural  research  on  online  trolling. 

31.  It  should  be  noted  that  CA  was  very  much  aware  of  this 
work  going  on  in  Russia  and  in  fact  sought  to  pitch  “the 
interesting  work  Alex  Kogan  has  been  doing  for  the 
Russians”  to  its  other  clients. 

32.  Contemporaneous  to  Dr  Kogan’s  data  profiling  work  in 
Russia,  CA  was  also  in  close  contact  with  senior 
executives  at  Lukoil,  one  of  Russia’s  largest  oil 
companies.  After  receiving  a  request  for  information 
from  Lukoil  executives  in  the  spring  of  2014,  CA 
discussed  with  Lukoil  its  experience  with  foreign 
disinformation,  rumour  campaigns,  microtargeting  and  its 
American  data  assets.  Mr  Nix  also  emailed  me  to  say 
that  he  was  passing  on  a  white  paper  I  wrote  outlining 
the  US  project  to  the  CEO  of  Lukoil. 

33.  It  should  be  noted  that  Lukoil  has  formal  information 
sharing  agreements  with  the  Russian  Federal  Security 
Service  (“FSB”)  and  is  known  to  conduct  intelligence 
gathering  on  behalf  of  the  FSB. 

34.  It  should  also  be  noted  that  CA’s  parent  company,  SCL 
Group,  has  managed  information  operations  projects  in 
Eastern  Europe  and  the  Baltic  region  and  may  have 
been  an  intelligence  target  at  the  time. 

35.  This  means  that  in  addition  to  Facebook  data  being 
accessed  in  Russia,  there  are  reasonable  grounds  to 
suspect  that  (1)  CA  may  have  been  an  intelligence  target 
of  Russian  security  services  at  the  time  of  Project  Ripon, 
(2)  that  Russian  security  services  may  have  been 
notified  of  the  existence  of  CA’s  Facebook  data  and/or 
methods  through  CA’s  frequent  contact  with  Russian 
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companies,  and  (3)  that  it  was  made  known  that  certain 
data  assets  could  have  been  accessed  inside  Russia  or 
via  accessing  Dr  Kogan’s  work  and  computers  using 
something  as  simple  as  a  keylogger  device  (with  or 
without  his  knowledge  or  consent). 

36.  Other  CA  contractors  have  worked  on  pro-Russian 
political  operations  in  Eastern  Europe,  including  work  in 
Ukraine  with  suspected  Russian  intelligence  agents. 
This  may  have  influenced  some  of  CA’s  research  in  the 
USA.  During  its  research  projects  in  2014,  CA  also  set 
up  focus  groups,  message  testing  and  polling  on 
Americans’  views  on  the  leadership  of  Vladimir  Putin  and 
Russian  expansionism  in  Eastern  Europe.  Of  note, 
Vladimir  Putin  was  the  only  foreign  leader  tested  by  CA. 

37.  In  short,  Cambridge  Analytica  (1)  used  Russian 
researchers  to  gather  its  data,  (2)  openly  shared 
information  on  “rumour  campaigns”  and  “attitudinal 
inoculation”  with  FSB-linked  Russian  companies  and 
executives,  (3)  pitched  Russian-led  profiling  projects  to 
its  other  clients,  (4)  contracted  people  who  worked  for 
pro-Russian  parties  in  Eastern  Europe  with  suspected 
Russian  intelligence  operatives,  (5)  referenced  the  use 
of  former  Russian  intelligence  agents  in  internal 
documents,  and  (6)  went  as  far  as  to  test  Americans’ 
views  on  Vladimir  Putin’s  leadership. 

38.  CA’s  behaviour  is  more  disconcerting  given  that  its 
parent  company  SCL  had  extensive  experience  working 
in  counter-extremism  and  military  projects  for  the  British 
and  American  governments.  It  should  have  known 
better. 

39.  To  be  clear,  no  allegation  is  being  made  that  any  CA 
personnel,  including  Mr  Nix  or  Dr  Kogan,  knowingly 
colluded  with  the  FSB,  GRU  or  other  Russian  agencies. 
However,  what  is  clear  is  the  gross  risk  of  data  breaches 
and  foreign  intelligence  gathering  created  by  CA’s 
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recklessness  in  the  face  of  skilled  intelligence  and  cyber 
operations. 

VOTER  DISENGAGEMENT 

40.  CA  did  not  operate  in  elections  to  promote  democratic 
ideals.  Oftentimes,  CA  worked  to  interfere  with  voter 
participation,  including  by  weaponising  fear.  In  one 
country,  CA  produced  videos  intended  to  suppress 
turnout  by  showing  voters  sadistic  images  of  victims 
being  burned  alive,  undergoing  forced  amputations  with 
machetes  and  having  their  throats  cut  in  a  ditch.  These 
videos  also  conveyed  Islamophobic  messages.  It  was 
created  with  a  clear  intent  to  intimidate  certain 
communities,  catalyse  religious  hatred,  portray  Muslims 
as  terrorists  and  deny  certain  voters  of  their  democratic 
rights.  I  have  seen  this  video,  but  to  be  clear,  I  had  no 
part  in  its  creation,  editing  or  deployment,  and  I  left 
before  the  company  made  use  of  it  in  the  field. 

41.  If  it  suited  the  client’s  objective,  the  firm  was  eager  to 
capitalise  on  discontent  and  to  stoke  ethnic  tensions. 
This  was  not  just  on  its  projects  in  Africa.  As  the  CEO  of 
SCL  said  in  a  recorded  conversation  about  the  firm’s 
work  in  the  USA  in  2016: 

“It’s  the  things  that  resonate,  sometimes  to  attack 
the  other  group  and  know  that  you  are  going  to 
lose  them  is  going  to  reinforce  and  resonate  your 
group.  Which  is  why  [. . .]  Hitler  attacked  the  Jews, 
because  he  didn’t  have  a  problem  with  the  Jews  at 
all,  but  the  people  didn’t  like  the  Jews  [...]  So  he 
just  leveraged  an  artificial  enemy.  Well  that’s 
exactly  what  Trump  did.  He  leveraged  a  Muslim 
[...]  Trump  had  the  balls,  and  I  mean,  really  the 
balls,  to  say  what  people  wanted  to  hear.” 

42.  I  am  aware  that  CA  clients  requested  voter  suppression 
as  part  of  their  contracts.  CA  offered  “voter 
disengagement”  as  a  service  in  the  United  States  and 
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there  are  internal  documents  that  I  have  seen  that  make 
reference  to  this  tactic.  My  understanding  of  these 
projects,  which  I  did  not  personally  participate  in,  was 
that  the  firm  would  target  African  American  voters  and 
discourage  them  from  participating  in  elections.  Mr 
Bannon  was  Vice  President  of  the  company  at  the  time 
of  these  voter  disengagement  projects. 

FACEBOOK'S  RESPONSE 

43.  Facebook  was  first  notified  of  CA’s  harvesting  scheme  in 
2015.  It  did  not  warn  users  then,  and  it  only  took  action 
to  warn  affected  users  three  weeks  after  the  Guardian, 
New  York  Times  and  Channel  4  made  the  story  public. 

44.  Facebook’s  behaviour  before  the  story  broke  was  to 
threaten  to  sue  the  Guardian.  Facebook’s  lawyers  also 
tried  to  intimidate  me  with  aggressive  legal  notices. 
Facebook  tried  to  shut  down  this  story  from  going  public 
when  it  knew  it  was  true.  At  the  British  parliamentary 
inquiry,  the  CTO  of  Facebook  recently  explained,  to  the 
surprise  of  many  in  the  inquiry,  that  the  company  had 
assumed  “that  this  is  common  practice  in  the  UK”. 

45.  Credit  should  therefore  be  given  to  the  international  team 
of  journalists  who  supported  me  as  a  whistleblower, 
stood  up  to  these  threats  and  nonetheless  dared  to 
publish:  Carole  Cadwalladr,  Sarah  Donaldson,  Emma 
Graham-Harrison,  Paul  Webster,  John  Mulholland  and 
Gill  Phillips  at  the  Guardian;  Matt  Rosenberg,  Nick 
Confessore,  Gabriel  Dance  and  Danny  Hakim  at  the 
New  York  Times;  Job  Rabkin  and  Ben  de  Pear  at 
Channel  4. 

46.  I  am  disappointed  that  Facebook  has  not  acted 
constructively  in  the  wake  of  this  scandal.  Before  the 
story  broke,  I  offered  to  help  Facebook.  One  of 
Facebook’s  Vice  Presidents  explicitly  told  my  lawyer  that 
they  would  welcome  a  collaborative  engagement,  but  at 
the  last  minute,  they  instead  announced  in  a  press 
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release  that  they  had  banned  me  from  their  platform.  I 
believe  I  was  banned  in  a  bungled  attempt  to  re-frame 
the  story  and  cast  Facebook  as  the  victim. 

47.  But  it  did  not  work.  Facebook’s  decision  to  ban  me  from 
their  platform  was  recently  debated  in  the  UK 
Parliament.  Responding  on  behalf  of  the  British 
Government,  the  UK  Secretary  of  State  for  Culture, 
Media  and  Sport  said  on  the  floor  of  Parliament  that: 

“Of  all  the  different  things  that  have  surprised  me 
and  shocked  me  in  this  revelation,  the  decision  by 
Facebook  to  take  down  the  whistleblower’s 
Facebook  account,  and  the  removal  of  their 
WhatsApp  account  and  the  Instagram  account, 
was  the  most  surprising”. 

48.  The  Secretary  of  State  went  further  to  call  the  ban 
“outrageous”  -  because  the  ban  is  outrageous.  It 
reveals  the  unrestrained  power  technology  companies 
have  over  users  when  a  person’s  entire  online  presence 
can  be  so  quickly  and  so  thoroughly  eliminated  from 
existence.  There  is  no  due  process  or  check  on  this 
power  and  my  ban  raises  a  serious  question  for 
Republicans  and  Democrats  alike:  what  happens  to  our 
democracy  when  these  companies  can  delete  people  at 
will  who  dissent,  scrutinise  or  speak  out? 

49.  Silicon  Valley  has  this  power  now.  I  know  because 
Facebook  used  it  on  me.  They  sought  to  make  me  a 
digital  pariah. 

50.  Facebook’s  actions  against  me  also  show  the  serious 
consequences  of  Silicon  Valley’s  rush  to  consolidate  the 
ownership  of  different  platforms.  Although  this  scandal 
had  nothing  to  do  with  Instagram,  my  account  on 
Instagram  was  also  eliminated  in  what  I  can  only  assume 
was  a  punitive  move  by  Facebook,  which  now  owns 
Instagram.  This  unchecked  monopoly  on  digital  space 
presents  a  serious  risk  to  people’s  rights. 
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51.  Facebook  also  demanded  that  I  hand  over  my  personal 
computer  and  phone  after  the  story  broke.  The  company 
disregarded  that  I  had  already  handed  over  evidence  to 
the  responsible  British  authorities  with  jurisdiction  over 
the  investigation.  In  effect,  Facebook  was  demanding 
that  I  let  them  acquire  and  handle  evidence  relevant  to 
an  ongoing  investigation  it  was  a  party  to.  The  company 
did  not  seem  to  understand  or  care  about  due  process  or 
respecting  the  integrity  of  an  ongoing  investigation  by  a 
competent  legal  authority. 

52.  I  remain  banned  from  Facebook  despite  the  UK 
Information  Commissioner’s  Office  confirming  in  writing 
that  I  am  “not  a  subject  of  [their]  investigation”. 

53.  I  would  like  to  be  able  to  discuss  the  data  security  and 
digital  privacy  issues  raised  by  my  evidence  with 
Facebook  in  a  non-confrontational  manner  and  help  it 
figure  out  how  to  move  forward.  I  came  out  as  a 
whistleblower  to  help  the  authorities  uncover  what 
happened.  But  I  also  want  to  work  towards  finding 
solutions  and  Facebook  is  a  key  player  in  finding  those 
solutions.  Platforms  like  Facebook  are  still  huge  public 
assets  that  do  a  lot  of  amazing  work,  but  we  should  not 
shy  away  from  the  real  problems  that  exist. 

54.  The  Cambridge  Analytica  scandal  has  exposed  that 
social  platforms  are  no  longer  safe  for  users.  We  have 
to  face  up  to  this  fact.  These  platforms  are  critical  parts 
of  American  cyberspace  in  desperate  need  of  protection 
and  oversight. 

55.  In  the  context  of  information  operations  from  hostile 
foreign  actors,  we  cannot  keep  relying  on  the  promises, 
apologies  or  good  intentions  of  these  firms  to  protect 
American  citizens.  We  protect  our  borders  at  land,  sea 
and  air  with  dedicated  public  agencies.  We  do  not  leave 
this  critical  public  service  to  private  companies  or  land 
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owners.  We  should  protect  our  digital  spaces  with  the 
same  level  of  care. 

56.  The  security  of  American  communities  online  is  one  of 
the  most  pressing  national  security  issues  in  the  21st 
century.  This  is  not  an  emerging  problem  on  the 
horizon.  This  is  not  a  niche  issue.  This  is  a  problem 
today,  in  the  here  and  now,  affecting  the  260  million 
Americans  who  use  social  media. 

57.  But  it  is  not  just  Americans  who  have  been  affected.  The 
rest  of  the  world  uses  and  often  depends  on  American 
technology.  But  as  we  have  seen  with  Mark 
Zuckerberg’s  continual  refusal  to  attend  the  British 
Parliament’s  inquiry,  it  is  impossible  for  other  countries 
like  the  UK  to  hold  these  companies  to  account.  To 
highlight  the  seriousness  of  the  matter,  the  British 
parliamentary  inquiry  is  now  considering  issuing  a 
standing  summons  on  Mark  Zuckerberg  after  the 
company  failed  to  answer  40  of  the  inquiry’s  questions. 

MOVING  FORWARD 

58.  What  I  bore  witness  to  at  Cambridge  Analytica  should 
alarm  everyone.  Cambridge  Analytica  is  the  canary  in 
the  coal  mine  to  a  new  Cold  War  emerging  online. 

59.  If  a  foreign  actor  dropped  propaganda  leaflets  by 
aeroplane  over  Florida  or  Michigan,  that  would 
universally  be  condemned  a  hostile  act.  But  this  is  what 
is  happening  online.  We  must  address  these  issues 
before  disinformation  and  information  warfare  become 
pervasive  in  American  cyberspace. 

60.  We  also  must  address  the  digital  echo  chambers  that  are 
being  exploited  to  algorithmically  segregate  American 
society.  Online  communities  should  unite  us,  not  divide 
us. 
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61.  But  we  cannot  keep  deferring  to  the  technology  sector 
with  the  defeatist  mantra  that  ‘the  law  cannot  keep  up 
with  technology’.  We  need  a  different  mentality. 
Technology  should  not  be  exempt  from  public  oversight 
or  debate  simply  because  it  relates  to  software.  If  we 
can  regulate  the  safety  standards  of  aeroplanes, 
medicines  or  nuclear  power  plants,  we  can  create  safety 
standards  for  software. 

62.  Every  year,  Americans  are  buying  more  and  more 
Internet-enabled  devices  and  appliances.  Soon  the  so- 
called  ‘Internet  of  Things’  will  become  the  norm  in 
American  households.  Algorithms  will  soon  be  driving 
our  cars  and  organising  our  lives. 

63.  This  is  not  just  about  technology  today,  we  have  to 
seriously  consider  the  implications  for  tomorrow.  To  put 
it  bluntly,  we  risk  walking  into  the  future  blind  and 
unprepared. 

64.  What  happens  when  your  cousin’s  DNA  profile  affects 
your  insurance  because  an  algorithm  has  used  someone 
else’s  data  to  infer  risks  about  you?  What  happens 
when  an  algorithm  targets  ads  that  provoke  your 
daughter’s  body  image  issues  because  it  has  inferred 
this  is  the  optimal  way  to  sell  her  a  product?  What 
happens  when  our  appliances  and  physical  spaces  are 
influenced  by  algorithms  that  start  to  make  decisions 
about  what  you  can  eat,  see  or  experience?  What 
happens  when  an  innocent  person  is  stopped  on  the 
street  because  the  police  used  a  biased  dataset?  What 
happens  when  monolithic  technology  platforms  start 
taking  sides  and  distort  our  elections? 

65.  Some  of  us  worry  about  big  government  robbing  us  of 
our  freedom  -  but  what  about  big  data? 

66.  Data  is  the  new  electricity  of  our  digital  economy.  And 
just  like  electricity,  we  cannot  escape  data.  It  is  nearly 
impossible  for  the  average  American  to  stop  using  social 
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media,  search  engines,  apps  and  e-mail,  but  still  be 
functional  in  the  workplace  and  in  society.  We  should 
therefore  be  wary  of  any  company  that  presents  a  false 
dichotomy  between  our  privacy  rights  and  living  in  a 
modern  digitised  society.  Online  platforms’  terms  and 
conditions  present  users  with  a  false  choice  because 
using  the  Internet  is  no  longer  a  choice.  Americans 
cannot  opt  out  of  the  21st  century. 

67.  Data  protection  is  a  consumer  safety  issue  and  we 
cannot  continue  putting  the  burden  on  consumers  by 
using  this  false  narrative  of  choice.  We  don’t  allow 
buildings  to  lack  fire  exits  as  long  as  there  are  terms  and 
conditions  posted  on  the  wall.  We  do  not  allow 
automotive  companies  to  build  unsafe  cars  as  long  as 
they  include  warning  labels.  In  every  other  sector,  we 
empower  public  regulators  to  create  safety  standards. 
Because  safety  matters.  So  why  should  software  and 
online  platforms  be  any  different? 

68.  Legislators  have  an  opportunity  to  create  expert-led 
technology  safety  authorities  to  enforce  standards  for 
user  safety,  just  as  we  already  do  for  everything  else  we 
value:  our  cars,  electricity,  appliances,  medicines, 
buildings  and  food.  Regulators  do  not  need  to  be  the 
adversaries  of  innovation,  but  innovation  must  always 
put  the  safety  of  people  first. 

69.  Technology  companies  may  claim  that  rules  inhibit 
growth  in  the  sector.  But  car  safety  standards  have  not 
inhibited  innovation  or  demand,  nor  have  they 
unreasonably  inhibited  profit.  Seat  belts  do  not  stop 
people  from  buying  cars  and  privacy  engineered 
software  will  not  stop  people  from  using  online  platforms. 

70.  Technology  is  a  social  issue.  Technology  is  a  national 
security  issue.  Technology  is  a  consumer  rights  issue. 
Everyone  has  a  stake  in  this,  not  just  engineers.  My 
generation’s  future  will  involve  technology  in  almost 
every  space  and  part  of  our  lives. 
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71.  lam  still  optimistic  about  the  future  of  technology.  But 
we  should  not  walk  into  the  future  blind,  and  it  is  the  job 
of  lawmakers  to  ensure  that  technology  serves  citizens 
and  not  the  other  way  around. 


CHRISTOPHER  WYLIE 
16  MAY  2018 
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